kubernetes/kops · error

parsing STS request URL: %v

Error message

parsing STS request URL: %v

What it means

verifyTokenV2 wraps url.Parse failure on decoded.URL — the STS endpoint URL embedded in the signed token. A malformed URL means the token cannot be replayed to STS for GetCallerIdentity, so verification aborts; later checks further restrict the URL host to legitimate STS endpoints.

Source

Thrown at pkg/bootstrap/awsbootstrap/verifier.go:233

	tokenBytes, err := base64.StdEncoding.DecodeString(token)
	if err != nil {
		return nil, fmt.Errorf("decoding authorization token: %v", err)
	}
	var decoded awsV2Token
	if err := json.Unmarshal(tokenBytes, &decoded); err != nil {
		return nil, fmt.Errorf("unmarshalling authorization token: %v", err)
	}

	// Verify the token has signed the body content.
	sha := sha256.Sum256(body)
	if decoded.SignedHeader.Get("X-Kops-Request-SHA") != base64.RawStdEncoding.EncodeToString(sha[:]) {
		return nil, fmt.Errorf("incorrect SHA")
	}

	reqURL, err := url.Parse(decoded.URL)
	if err != nil {
		return nil, fmt.Errorf("parsing STS request URL: %v", err)
	}
	signedHeaders := sets.New(strings.Split(reqURL.Query().Get("X-Amz-SignedHeaders"), ";")...)
	if !signedHeaders.Has("x-kops-request-sha") {
		return nil, fmt.Errorf("unexpected signed headers value")
	}

	if !a.stsRequestValidator.isValidV2(reqURL) {
		return nil, fmt.Errorf("invalid STS url: host=%q, path=%q", reqURL.Host, reqURL.Path)
	}

	callerIdentity, err := a.stsRequestValidator.getCallerIdentityV2(ctx, &a.client, &decoded)
	if err != nil {
		return nil, err
	}

	return verifyCallerIdentity(ctx, callerIdentity)
}

View on GitHub (pinned to 4c8573c808)

Solutions

1. Regenerate the presigned URL
2. Avoid characters that break URL parsing
3. Use matching kOps client/server versions

When it happens

Trigger: Thrown at pkg/bootstrap/awsbootstrap/verifier.go:233 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/efa20992e7e96731. Report an issue: GitHub.